Passive keyless (PK) systems include passive keyless entry and start (PKES) systems, passive keyless entry (PKE) systems (without passive start), as well as passive keyless start (PKS) systems that may not provide for passive entry. A PK system may include the use of a key or require other user action for either entry or vehicle start (ignition-on). The passive keyless entry and start (PKES) system generally includes a vehicle receiver, a vehicle transmitter and a portable keyfob, which is used to passively authorize a user and to carry out a vehicle function (e.g., door unlock). Alternatively, a single transceiver may be used in place of a separate receiver and transmitter. In general, PKES systems are configured to allow access and allow the vehicle to start as long as the portable keyfob is within a prescribed zone in proximity to or within the vehicle. Under normal operating conditions, passive authorization in PKES systems is initiated by an attempt to enter and/or start the vehicle. In some embodiments, the attempt is made by pressing a button on or near an exterior door handle and/or by touching, pulling or lifting a door handle; while in other embodiments, the PKES system automatically initiates the vehicle function when the presence of the keyfob is detected. In either case, passive authorization is accomplished by sending a random interrogation signal from a vehicle LF base-station to the keyfob. In response, the keyfob transmits a validating response signal to a vehicle receiver or transceiver. Due to the passive nature of authorization, PKES systems may be susceptible to wireless attacks, and in particular, to relay attacks.
In relay attacks, the vehicle may be unlocked and started when the portable keyfob is not within the required proximal zone of the vehicle. The use of relay signals trick the fob and vehicle into concluding that the portable keyfob, and hence the vehicle users, are within the prescribed proximity and thus performs the requested operation. Therefore, thieves may gain entry to the vehicle. FIG. 1 illustrates one example of a relay attack wherein a vehicle 1 is equipped with a PKES system having a vehicle receiver/transmitter (transceiver) 2; a portable keyfob 3 being carried by the vehicle's owner or other authorized user 4; and first and second thieves 5, 6. The first thief 5 may place a first repeater (FR) 7 near the target vehicle 1 and the second thief 6 may carry a secondary repeater (SR) 8. The repeater is a device that receives and retransmits the signal (i.e., relays the signal). It may contain a processor and a modem; thus, the received signal may be modulated prior to being retransmitted (e.g., to a different frequency, encoded, etc.). In addition, the repeaters 7, 8 may communicate wirelessly or by wire. In any case, the first thief 5 first acquires an interrogation signal from the vehicle 1. This may be accomplished by merely placing the FR 7 near the vehicle 1 in systems that periodically or continuously transmit an interrogation signal via the vehicle transceiver 2. In some systems, the interrogation signal is emitted by the transceiver 2 once a button is pressed on the vehicle door handle or the vehicle door handle is pulled or lifted. Upon acquisition of the interrogation signal, the FR 7 sends the signal to the SR 8. Provided the second thief 6 is close enough to the victim 4, the keyfob 3 will respond to the interrogation signal sent from the SR 8—being tricked into believing that the vehicle 1 must be nearby. The keyfob 3 sends a validating response signal which is in turn captured by the SR 8 and relayed to the FR 7, which in turn relays it to the vehicle 1 where it is received by the transceiver 2. The transceiver 2 then validates the response signal and unlocks the vehicle doors.
For some keyless systems, a similar process may be performed in order to start the vehicle 1. In some instances, the vehicle doors must first be closed before the vehicle 1 will send an interrogation signal via the transceiver 2; in some systems, a start button inside the vehicle 1 must be actuated first. Furthermore, in some PKES systems, there are multiple transmissions between the transceiver 2 and the keyfob 3 prior to unlocking the vehicle doors or starting the vehicle 1 (e.g., first a wake-up signal from the transceiver 2 and an acknowledgement signal from the keyfob 3; then an interrogation signal from the transceiver 2 and then a response signal from the keyfob 3). Also, while there is generally only one FR 7 required, thieves may use multiple SRs 8. The SR(s) 8 may be strategically positioned rather than carried by the thief 6 (e.g., near one or more entrances or hallways where the victim 4 is likely to walk after exiting the vehicle 1). In wireless repeater systems, the range of reception/transmission may vary depending upon such factors as design and environment. Regardless, the SR 8 typically needs to be relatively close to the victim's keyfob 3 (e.g., 1-3 meters away).